Feature
2,271 bytes gzipped, zero runtime dependencies, and it is not allowed to break your page, whatever happens on our end.
Zero dependencies, checked by CI.
The package has an empty dependencies field. This script runs on every page of every customer site, so a supply-chain compromise anywhere in a dependency tree would be a compromise of all of them.
A 5KB budget CI actually enforces.
The build fails, not warns, if the gzipped bundle crosses 5,120 bytes. Today it sits at 2,271 bytes, 44% of that ceiling, measured by the same script CI runs.
It never throws into your page.
Every public method, and the script-tag bootstrap itself, runs inside a guard. A malformed configuration attribute fails silently rather than breaking your site.
One request per batch.
Events queue in memory and flush at 10 events or 3 seconds, using sendBeacon where available so a page closing mid-flush does not lose the batch.
Offline does not mean lost.
A failed send is kept in sessionStorage, namespaced per project, and retried on the next page load or when the connection returns. Session storage, not local storage, so cookieless mode never writes anything durable to the device.
No fingerprinting, ever.
No canvas, no WebGL, no font enumeration, no audio context. Not for analytics, and not for bot detection either.
If a project turns replay on, a second script loads, but only for the sessions that are actually sampled and recorded. It bundles rrweb, the library that does the recording, and it is nowhere near 5KB: the current build is 58,240 bytes gzipped, against its own separate 60KB budget. That number belongs to a feature you opt into per session, not to the script every visitor downloads, and this page would be dishonest if it let the two blur together.
One script tag with a project id. You can also self-host the script from your own origin and proxy the endpoint through a first-party path, which removes the third-party request entirely.
<script defer src="https://metricward.eu/mw.js"
data-project="prj_yours"></script>The rolling URL above cannot carry Subresource Integrity, because the file changes between releases. Versioned, SRI-pinned delivery is designed but not shipped yet; today the way to get a pinned artefact is to self-host the file on your own origin, where you control exactly when it changes.